I really would love to use client-side certificates everywhere. It's just too much of a pain in the ass to do so.

Off the top of my head: - Generating client-side certificates is expensive or a pain in the ass. - Every browser deals with client-side certificates differently. Some give scary warnings, etc. - Firefox and IE can generate keys locally and send a CSR to you, but they do it differently. Safari can't even generate keys locally.

I really wish that the state of client-side certificates was better than it is. I look forward to the day when I can easily build services that use client-side certificates.